opennetadmin / ona Goto Github PK

I think it would be sweet to be able to kick off an Nmap scan for a specific subnet from within the GUI. It would be neat to have a buttom somehwere on the subnet page that allowed you to start the scan. Then it could notify when it's done and the new report is generated for you to view. Just a thought.

columns with the following name: level, number and file are not allowed as Oracle column names. I changed to number_, level_ and file_ and change the code.

do something to fix the column names so they are compat with other DBs.

The installer should check for php5-mysql and/or related functions. When other databases are supported there should be similar checks

check for php-mbstring as a requirement during install..

EDIT: I already do this goofball!

When pointing the vmware stats plugin at a 5.x vcenter I recieve the following (truncated) error

" PHP Fatal error: Uncaught SoapFault exception: [ServerFaultCode] Attribute name xsi:type uses an undefined namespace prefix xsi\n\nwhile parsing MoRef for ManagedObject of

Delegating subdomains (subdomain.example.com IN NS server.example.com) does not work/show because the name field of an NS record gets cleared in ona/www/winc/list_records.inc.php line 353 and in build_bind.inc.php line 446 only $domain['fqdn'] is used instead of $dnsrecord['name'].$domain['fqdn']

So adding "subdomain.example.com IN NS server.example.com" does work, but shows up as "example.com".

Is there a reason for this behavior?

bziller

I'm not able to recreate this on my end. It seems to be working for me.. Please explain in a bit more detail the steps you use to set it up.

The reason it does not use $dnsrecord['name'].$domain['fqdn'] is that NS records only store the domain information and not the host/name portion. A records for example are a host and a domain together to get an FQDN. NS records leave the name field blank in the database and only store the domain information.

you should have a domain in your system as example.com then a second domain defined as subdomain.example.com. Then when you add a domain server assignment or you manually create the NS record it will point the subdomain.example.com domain to the A record server.example.com as an NS type.

Lets see if we can get the steps in order so I can try and duplicate on my side and see whats up.

Thanks.
Comment by Bernd Ziller (bziller) - Monday, 28 September 2009, 11:32 GMT
Since I'm not responsible for subdomain.example.com, it doesn't help to add this subdomain to ona, because this way there will be no NS entry in example.com delegating subdomain to server.example.com.
So in this case the NS record has the need to store the name field.

I need a "subdomain.example.com IN NS server.example.com" in domain example.com.

I currently can't reproduce this (adding "subdomain.example.com"). I was quite sure I didn't mess with the DB in the first place, but it looks like I did ;)
At the moment I'm trying to add the needed behavior into ona.
Comment by Matt Pascoe (matt) - Wednesday, 30 September 2009, 20:12 GMT — Edit — Delete
I would suggest that even though you are not responsible for subdomain.example.com that you still add the domain to ONA. It is referential only and you would not need to add any more records or data to it. Once it is added then you can point at it for NS records. You can simply click the "add dns record" link and create the NS record that way.

The alternate way of doing this is with zone trailer files. It is something I've not fully built into the BIND build code yet but it will be coming. In my tinydns build code I already have it implemented. Basically it is a file that you can define for each zone that gets appended to the data extracted from ONA. It will allow you to define records in the zone that ONA may not support. In this case, ONA should support the record properly but you may not want to define the subdomain.example.com zone in your system.

Hope that helps.

The ZIP code is being displayed as a number, causing leading zeros to be dropped so 01234 becomes 1234. This is not critical, but if this is ever used someplace else (like to pull up the address in Google Maps) this might cause problems.
Proper behavior would be to store and manipulate the ZIP code as a string. This would allow not only the correct numerical codes for the US, but also alpha numeric codes used in places like GB or FR.

At one point ONA was compliant with RFCs stating that an underscore is an invalid character. When adding support for SRV records these checks went away. (RFC 952 and RFC 1123)

It would be best to add this check back in for the appropriate records. But since it may create challenges for people trying to load data into ONA it should be an option that can be disabled.

I think at this point it would be on by default to encourage proper DNS record formats but can be off if desired. This may require you to use something like the check-names option in BIND however.

There are some situations where knowing that the new A record you are adding is using an existing name. Some times having multiple hosts that have the same name but different IPs added over time creates "duplicate" names. While adding multiple A records with the same name and different IP addresses is perfectly normal, its not desired to have same name on two different hosts (its usually used for service IPs and clusters etc)..

The thought is to create a JS alert that will just tell the user that there is another A record with that name. hopefully it wont be too annoying since the % of these types of legit records is low.

I have create a domain, subnet 172.16.20.0/26, but when i would like to add the machines found by the nmap_scan_cron they alway go in to the 0.0.16.172 instead of the 20.16.172 .

This is not correct to me.

From Old bug system:

It would be nice if the location fields supported more than a 'US' centric view. I would like to use this offering to manage our global network, but it needs to have support in the location attributes for countries and regions, let alone address format, that does not conform to a US standard.

Also - it would be nice if there were more than one address line field.

ONA presents an alert when an attempt is made to use one of non-useable IPs (Subnet and broadcast) for NAT:
Save failed. ERROR => IP address (x.x.x.x) can t be a subnet s base address!

Subnet and broadcast IPs of routed CIDR subnets are legitimate. Perhaps this alert could be changed to a warning to let user proceed regardless?

Create the option to have a dns record expire on a certain date. This would be the opposite of the current dns 'begin date' functionality.

Have a button on each ip interface line in lists that allows you to navigate to the next IP in the database.. so if you are viewing a host with multiple IPs.. it could have right/left arrows that would take you to the host with the next incremental IP in either direction... possibly have this as a configuration option that could be enabled or disabled.

I think putting it on the list interfaces lines next to the green plus would be the place..

While ONA strives to be solution generic when it comes to support of DNS/DHCP services, there are still needs that arise when building configurations that are specific to one platform or another.

Specifically BIND supports many options that control policies, zone transfers etc etc. These options are not applicable for something like a TinyDNS server.

The current method I envision for allowing full support of these items while remaining fairly generic in nature would be to do the following:

• Create a new text column in the domains table called domain_options. it should be fairly large so it can contain enough data.
• in the GUI create a textarea edit box for these options
• update appropriate domain add/modify modules to support this new column
• update the build_bind plugin to use this data

These changes should allow someone the ability to type in a bind config format configuration in a freeform text field that will get automatically merged in during zone configuration time. This way they have full configuration flexibility without the need for ONA to have full understanding of each and every bind specific option that exists or may exist in the future.

I believe this to be a good mix of feature capability and ease of implementation.

I dont know is it a bug or need as feature but when I look at report of nmap scan and click Add Host i would like to MAC Field be filled like IP Address .

Currently the only way to add global DHCP options that are ONA system wide and are applied as defaults for all DHCP servers, subnets, hosts is to add a DHCP server and then you are allowed to add the global options. This is not as intuitive as it could be. While it is nice to have the option to edit the global options from any DHCP server, it should not be the only method.

Add a link in the admin menu to the global DHCP option editor. There will need to be a new app_list_global_dhcp_options as well to list them for editing.

Many of the dcm.pl tools suggest that if you only put in a host and no domain portion of a name that it will add on the default domain.

This was the case at one point but some code changes broke this. see if there is a good way to fix this behavior

currently defining forward zones is broken entirely. A lot of this has to do with the build bind script.

secondly both forward and slave zones only allow for domains with masters that are defined in ONA. I should be able to add a field to dns_domain_servers table that would allow these zones to use a list of IP addresses that were manually added. If this field is provided it will add the value into the list.

This should allow me to mix both entries from ONA and the static list if provided to become a full list of slaves/forwarders in the DNS config.

In order to support the classless IN-ADDR.ARPA delegation, it's required to (1) generate a bind config with domain name like '192/26.2.0.192.in-addr.arpa.' -- for 192.0.2.192/26 being delegated to ONA's DNS server.
Another change (2) is to provide ip numbers in PTR records relative to $ORIGIN, instead of giving FQDN to the left from 'PTR'.

So, ideally we need something like this for the network 192.123.161.0/25
==========
$ORIGIN 0/25.161.123.192.in-addr.arpa.
$TTL 86400
;Serial number is current unix timestamp (seconds since UTC)

@ IN SOA server.example.com. hostmaster.example.com. (1259378388 86400 3600 3600 3600)

0/25.161.123.192.in-addr.arpa. IN NS server.example.com.
1 IN PTR gw.example.com.
2 IN PTR host1.example.com.
==========

Having that, we can add to header's named.conf:
zone "0/25.161.123.192.in-addr.arpa" in {
type master;
file "/etc/bind/zone_data/named-161.123.192.in-addr.arpa";
// allow-transfer { slave_dns; }; // to support slave dns
};

========== solution ==========
The (1) change should be made in www/include/functions_general.inc.php to allow '/' symbol in a host name:

diff /tmp/original/ona/www/include/functions_general.inc.php functions_general.inc.php
887c887
< if (preg_match('/^([a-z0-9_\*]([a-z0-9_\.\-]*))?[a-z0-9]$/', $string)) {

---
> if (preg_match('/^([a-z0-9_\*]([a-z0-9_\.\-\/]*))?[a-z0-9]$/', $string)) {

==
The (2) change is made in build_bind.inc.php.diff
$ cat build_bind.inc.php.diff
415c415,418
< $text .= sprintf("%-50s %-8s IN %-8s %s.%-30s %s\n" ,ip_mangle($interface['ip_addr'],'flip').'.in-addr.arpa.',$dnsrecord['ttl'],$dnsrecord['type'],$ptr['name'],$ptr['domain_fqdn'].'.',$dnsrecord['notes']);

---
> # $text .= sprintf("%-50s %-8s IN %-8s %s.%-30s %s\n" ,ip_mangle($interface['ip_addr'],'flip').'.in-addr.arpa.',$dnsrecord['ttl'],$dnsrecord['type'],$ptr['name'],$ptr['domain_fqdn'].'.',$dnsrecord['notes']);
> $ip_last_digit = ip_mangle($interface['ip_addr'],'flip');
> $ip_last_digit = substr($ip_last_digit, 0, strpos($ip_last_digit,'.'));
> $text .= sprintf("%-50s %-8s IN %-8s %s.%-30s %s\n" ,$ip_last_digit,$dnsrecord['ttl'],$dnsrecord['type'],$ptr['name'],$ptr['domain_fqdn'].'.',$dnsrecord['notes']);

===

It works for me, so it might be that i forgot to mention something else. If it does not work for you, then please look through my full diff at http://netserver.chtd.tpu.ru/ona_diff/ona.diff It gives support for both UTF-8 symbols and classless delegation.

Alex K (from old bug system)

After creating a vlan "X" on campus "Foo" with subnet "10.1.2.0/24", then adding vlan "X" on campus "Bar" with subnet "10.2.2.0/24" failes with "ERROR => The vlan/campus pair specified is invalid!"

I can do exactly the same creation through the GUI. I've not dug into the code, but I strongly suspect that dcm.php or something is doing a check to make sure that the VLAN is not a duplicate, rather than the VLAN/Campus is not a duplicate. I'll go digging for this and if I find something, I'll update where it is.

Just gonna put this out here and see if any one takes an interest. One of our people thinks ONA is so awesome kinda expected it to do something like this. I thought it was a great idea. I hate creating and keeping up to date 3 different domains that are basically all the same.

Situation: You have a domain and to protect your namespace you register the .com .org and .net equivalents

Problem : You want everyone who visits any of the domains to be able to land in the one you actively manage (lets say .com)

Solution: Virtual Domains. Basically a way to generate the bind files for domains that are basically copies of other domains. You manage one but ONA generates zone files for all 3. So the www.foo.org and www.foo.net A records get created when you create an A record for www.foo.com. any changes in the .com propagate to the .org .net etc domains automagically.

Bonus: Exceptions. I want everything the same but www should be independently changed across all 3 domains (i.e. each points to a different place)

Thoughts comments?

Create a plugin for managing AS numbers. its possible it could be tied to blocks in some way but that may cause more requirements on data than needed.. its likely simpler to just define an address/mask and as number.

Need this for dhcp-option 249 (and 121).
Workaround: define this option in the header-file

Since php-ldap module is required by the auth_ldap code.. have a check that makes this issue more obvious.

It seems is_ipv4() function can't be created in the last ONA release if we don't install the GMP module. It results on a 500 error when trying to create a network object.

ONA apparently let me delete the CNAME record I used for the primary master of my DNS domain. So my SOA record ended up pointing to a non-existent machine. I don't think anything was affected. But should this be allowed?

In the host dialog and creation/modify add an offline flag. This will default to false/no but can be set to true.

The intent here would be to allow a host to be flagged as offline so that things like DNS/DHCP builds do not process anything related to the host. Also ona_nmap_audit scans or any other process within the system can ignore the host as needed.

It should also have a timestamp of when it was flagged.. so maybe its just a date field that if it is populated its flagged, if its blank then its active.

Do the same for subnets

allow per subnet/ip range access..

Add an attribute to flag an IP address as the gateway IP for a subnet. this is similar to the "primary DNS name" for a host.

there can be only one -- highlander

come up with some sort of indicator icon that shows in list hosts (only if listing IPs for the subnet displayed) and list interfaces.

Some users dont need or use the DHCP dialogs and configuration. have an option to disable them. Maybe just turn them into a plugin like any other instead of it being built in directly. that way people can install the plugin as needed.

When you have a server that is part of a failover group and not explicitly assigned to a subnet then the count of subnets is incorrect in the view->list dhcp servers app. Not a huge deal but it is not correct.

Global DHCP settings such as 'authoritative' and 'max-lease' are currently managed by including a header file to the output built from ONA. Investigate putting this text configuration as a database record stored with the dhcp server table that would be visible within the GUI. Then it would simply be emitted as part of the configuration build scripts. This would keep things all in one place and more apparent.

There have been a lot of confusion with people not having that module and it messing with ONA. Need to have a check in the installer for it.

Add a next and previous button to the list of icons next to each interface on a host. This will allow you to navigate to the next allocated host on the same subnet as the current IP.

This should give a path for moving around such that you dont have to navigate back to the subnet and then select a host.

Still need to determine how to behave when there are no more hosts to navigate to. If its simple enough, just dont print the button..

Currently when you first start working in ONA and you add your first host, you will be prompted to create a PTR (in-addr.arpa) dns domain to store PTR records in. While this is good from a data integrity standpoint to ensure that data is available for building DNS zones it is not always useful for all users.

Investigate a way to let users disable the PTR warnings and creation in the event they dont care about the DNS side of ONA. Not currently sure how annoying this will be to implement but I suspect it shouldn't be horrible.

If a DNS zone is defined with a parent (not required) and you try to modify the name of that domain, the logic is not correct in determining if the new name is a duplicate or not. Bottom line, when using parents you may not be able to rename the zone.

This is likely to not be a huge issue as the use case in renaming a domain is fairly low.. you can always remove and re add it with the correct name.

In larger environments especially, it is useful to keep track of the patch panel field in terms of what server/device is plugged into what port on what panel in relation to the TIA/EIA 606-A structured cabling standard. I think that this kind of documentation fits in well with the overall framework that ONA is creating.

To take the current IP address hierarchy as a model I would suggest that patch panels be subcontainers of a rack container and then a port exists within a patch panel. Then there would be linkage between an interface on a server/device and the port.

Unfortunately I don't have the PHP skills to code the GUI portion, but with help on that I could probably contribute to the underlying functions and procedures.

Moved from old bug tracker

I look at Subnet SCAN and last entry i got :

up 10.10.3.242 00:50:56:AA:00:02 10.10.3.242 itforum.domain.local 005056AA0002 Update DNS
up 10.10.3.249 00:22:68:1A:87:BD 10.10.3.249 l0078lubp110.domain.local 0022681A87BD Update DNS
up 10.10.3.254 00:50:56:00:00:20 NOT FOUND Add as host or Add as interface, check proper pool range

10.10.3.254 is IP Address of gateway for this subnet and server where ONA is istalled . But MAC Address is last known discovered host (in XML) - host is addedd to ONA database) which IP is 10.10.3.250 , so i think report parser enter in table wrong MAC Address for last host ?

host>
address addr="10.10.3.249" addrtype="ipv4" />
address addr="00:22:68:1A:87:BD" addrtype="mac" />
hostnames />
/host>
host>status state="up" />
address addr="10.10.3.250" addrtype="ipv4" />
address addr="00:50:56:00:00:20" addrtype="mac" vendor="VMWare" />
hostnames>
/host>
host>status state="down" />
address addr="10.10.3.251" addrtype="ipv4" />
/host>
host>status state="down" />
address addr="10.10.3.252" addrtype="ipv4" />
/host>
host>status state="down" />
address addr="10.10.3.253" addrtype="ipv4" />
/host>
host>status state="up" />
address addr="10.10.3.254" addrtype="ipv4" />
hostnames />
/host>
host>status state="down" />
address addr="10.10.3.255" addrtype="ipv4" />
/host>

PS. I have to delete left brackets from XML output pasted because GIT HUB didnt show message

Proxy has been set to a valid proxy using the format: "http://hostname:port/"
but version check still reads: "Latest version = Unable to determine"

For security reasons, databases and user accounts should be created by a DBA, not via a script. Privileges to drop/create users and databases should not be given to application accounts. When the database and user are pre-created, two things happen during the install:

1. It reports the database was dropped and created, although this isn't true. The user doesn't have privilege to drop nor create. The install does continue though. Maybe a check could be added to see if the database already exists and report accordingly? If it exists, check for tables. No tables, it's done. If there are tables, put them in an array and loop through dropping them. The install continued, so I didn't worry about it.

2. It fails with "Failed to create system user...". The install fails with a fatal error. For this, I did the following as a temporary fix. I figured I'd share in case anyone else comes across the same thing.

In install/install.php, lines 494 through 507. Currently looks like:

          if ($status == 0) {
            // it is likely that this method here is mysql only?
            if(@$db->Execute("GRANT ALL ON {$database_name}.* TO '{$sys_login}'@'localhost' IDENTIFIED BY '{$sys_passwd}'")) {
                @$db->Execute("GRANT ALL ON {$database_name}.* TO '{$sys_login}'@'%' IDENTIFIED BY '{$sys_passwd}'");
                @$db->Execute("GRANT ALL ON {$database_name}.* TO '{$sys_login}'@'{$database_host}' IDENTIFIED BY '{$sys_passwd}'");
                @$db->Execute("FLUSH PRIVILEGES");
                $text .= "<img src=\"{$images}/silk/accept.png\" border=\"0\" /> Created system user '{$sys_login}'.<br>";
                printmsg("INFO => Created new DB user: {$sys_login}",0);
            }
            else {
                $status++;
                $text .= "<img src=\"{$images}/silk/exclamation.png\" border=\"0\" /> Failed to create system user '{$sys_login}'.<br><span style='font-size: xx-small;'>".$db->ErrorMsg()."</span><br>";
                printmsg("ERROR => There was an error creating DB user: ".$db->ErrorMsg(),0);
            }

            // add the default domain to the system
            // This is a manual add with hard coded values for timers.
            $xmldefdomain = <<<EOL

Change to:

          if ($status == 0) {
            // it is likely that this method here is mysql only?
            if ($db->NConnect( $database_host, $sys_login, $sys_passwd, $database_name)) {
            $text .= "<img src=\"{$images}/silk/accept.png\" border=\"0\" /> System user '{$sys_login}' already exists.<br>";
                printmsg("INFO => DB user exists: {$sys_login}",0);
            }
            elseif(@$db->Execute("GRANT ALL ON {$database_name}.* TO '{$sys_login}'@'localhost' IDENTIFIED BY '{$sys_passwd}'")) {
                @$db->Execute("GRANT ALL ON {$database_name}.* TO '{$sys_login}'@'%' IDENTIFIED BY '{$sys_passwd}'");
                @$db->Execute("GRANT ALL ON {$database_name}.* TO '{$sys_login}'@'{$database_host}' IDENTIFIED BY '{$sys_passwd}'");
                @$db->Execute("FLUSH PRIVILEGES");
                $text .= "<img src=\"{$images}/silk/accept.png\" border=\"0\" /> Created system user '{$sys_login}'.<br>";
                printmsg("INFO => Created new DB user: {$sys_login}",0);
            }
            else {
                $status++;
                $text .= "<img src=\"{$images}/silk/exclamation.png\" border=\"0\" /> Failed to create system user '{$sys_login}'.<br><span style='font-size: xx-small;'>".$db->ErrorMsg()."</span><br>";
                printmsg("ERROR => There was an error creating DB user: ".$db->ErrorMsg(),0);
            }

            // add the default domain to the system
            // This is a manual add with hard coded values for timers.
            $xmldefdomain = <<<EOL

When viewing the IP blocks after entering a classless supernet, all nets are shown for the full classfull range.

Re-opening bug ID 343 from the old tracker: http://opennetadmin.com/bugs/index.php?do=details&task_id=343

Steps to reproduce:

1. Create domain as test.net
2. Create subdomain net with parent reference to test.net
3. Add host to domain created in step 1 (e.g. test.test.net)
4. Host is created as test.test.net.net.test.net

I created 2 examples test3.testnet.net and test2.testnet1.net in the demo install.

Renaming subdomain created in step 2 or removing parent reference and changing domain name to FQDN net.test.net resolves this, but that defeats the purpose of domain hierarchy functionality.

You apparently can't use an ! in the password. The system let me set it, but then would fail to let me login when using it.

When using the rack-maint plugin, the racks are always numbered from from top to bottom.

It would be nice to have the ability to set the ordering on a per rack basis

when adding a domain such as 10.in-addr.arpa you will get an error if there is a trailing dot at the end. The module should allow the dot to be passed in and normalize the data before storing instead of giving an error.

Once you select a location using the quick find popup via binocular icon, it will not populate the selection in the location ref field of the search form.

Hi i added 3 subnets
10.10.0.0/22 , 10.10.250.0/24 and 192.168.200.0/24 , when i check "Show global issues" its display only 10.10.0.0/22
Xml file are created and looks ok , when i manual enter 192.168.200.0 it shows issues for this subnet but never works with 10.10.250.0/24 subnet .

Another bug is that when i looka at report it writes next to added hosts "Update DNS" , but i check a few times and DNS records looks ok.

I had "OpenNetAdmin - v11.02.10 Release"

there is an interface_move module that allows you to move IP addresses from one subnet to another using start and end ranges. This process does not have a GUI interface however. Time to create one.

Also, make a way to "split" subnets. this would be more of an operation of creating a new subnet during the process of changing a mask on the original subnet.

Complete the view support. Minimal support exists at the data input level.

1 The current dns_views table needs to have a sort order column added as views are processed first come first served in the file.

2 Also it should have a match column to define what the view match statement is, for completeness however this may need to simply be an open text field so you can add whatever options you wish.

3 The build bind scripts must also then support the ability to build configuration with views.

4 Tinydns also supports a form of views that should be enabled using these views.

5 the ability to manage views does not yet exist.. a way to add/modify/delete them needs to be built